KR102179769B1 - Method to enforce network policy with commodity multiqueue, recording medium and device for performing the method - Google Patents

Abstract

A network policy application method supporting multiple queues includes: a step of initializing an intra-module tenant mapping array, a tenant weight array, a starting queue index array, and a port number array and variables based on network policy content submitted by a network administrator; a step of ensuring inter-tenant network isolation by assigning a network interface card (NIC) queue by the weight assigned to each tenant based on the tenant ID, the tenant weight, and the tenant′s starting queue index and current queue-tracking index acquired from the initialized arrays; and a step of ensuring network isolation between intra-tenant applications by inserting a high-priority application packet into the head of Qdisc in order to differentiate the priorities of the intra-tenant applications. According to the present invention, it is possible to apply an intra-server network policy by means of multiple packet schedulers, with an existing commercial MQ-NIC alone, and even without cost and replacement time necessary for new hardware development.

Description

How to apply a network policy that supports multiple queues, recording media and devices for performing this {METHOD TO ENFORCE NETWORK POLICY WITH COMMODITY MULTIQUEUE, RECORDING MEDIUM AND DEVICE FOR PERFORMING THE METHOD}

The present invention relates to a method for applying a network policy supporting multiple queues, a recording medium and an apparatus for performing the same, and more particularly, to a method for processing packet data, and includes network interface cards supporting multiple queues. NIC) in a computer server device equipped with a technology for expressing various packet scheduling methods.

The servers in the cloud data center are shared by multiple tenants using various applications. Servers are the first bottleneck in the data center network, so tenants need network isolation between tenants and between applications within tenants.

To ensure network isolation, operators specify network policies, such as assigning weights between tenants and prioritizing between applications with different performance requirements within tenants, and these network policies are usually in the packet scheduler. Applied by

Meanwhile, today's 10Gbps or higher high-speed network interface cards (NICs) support multiple queues. In a NIC supporting a single queue, the application of network policy through packet scheduling took place in qdisc in the server, but in a server equipped with a multi-queue supporting NIC (MQ-NIC), the NIC becomes the final network policy application point.

However, today's MQ-NIC only supports a Round-Robin (RR) packet scheduler to ensure per-queue fairness. Although it is possible to design NIC hardware supporting various packet schedulers, this has a drawback in that it incurs excessive replacement cost and requires a considerable amount of time until actual deployment.

KR 10-1489414 B1 KR 10-0817676 B1 US 9225659 B2

Accordingly, the technical problem of the present invention is conceived in this respect, and an object of the present invention is to provide a method of applying various network policies in a network server equipped with a multi-queue NIC only by a software method without hardware modification.

Another object of the present invention is to provide a recording medium in which a computer program is recorded for performing a method of applying a network policy supporting the multiple queues.

Another object of the present invention is to provide an apparatus for performing a method for applying a network policy supporting the multiple queues.

A network policy application method supporting multiple queues according to an embodiment for realizing the object of the present invention is, based on the network policy content submitted by the network administrator, a tenant mapping arrangement in a module, a tenant weight arrangement, and start Initializing a queue index array and a port number array and variables; Based on the tenant ID obtained from the initialized array, the tenant weight, the tenant's starting queue index, and the index tracking the current queue, network interface cards (NIC) queues equal to the weight assigned to each tenant are allocated. Thereby ensuring network isolation between tenants; And inserting a high-priority application packet into the head of Qdisc in order to have different priorities between applications in the tenant to ensure network isolation between applications in the tenant.

In an embodiment of the present invention, in the step of ensuring network isolation between tenants, when the value corresponding to the index tracking the current queue of the tenant is equal to or greater than the weight of the corresponding tenant, the value corresponding to the current queue index is initialized to 0. can do.

In an embodiment of the present invention, in the step of ensuring network isolation between tenants, the queue mapping metadata of the socket to which the packet currently being processed belongs, the value corresponding to the index tracking the current queue of the tenant, and the start queue index. It can be updated with the summed value.

In an embodiment of the present invention, the step of ensuring network isolation between tenants may further include updating an index tracking a current queue for a next packet.

In an embodiment of the present invention, in the step of ensuring network isolation between applications in the tenant, if the port of the packet currently being used is included in the port number array, the priority metadata value of the socket to which the packet currently being processed belongs is set to 1. By setting, a high priority can be given, and in other cases, a lower priority can be given by setting the priority metadata value to 0.

In an embodiment of the present invention, a method of applying a network policy supporting multiple queues may determine whether to enqueue a packet currently being used based on a queue mapping metadata value of a socket to which the packet currently being processed belongs and the priority metadata value. It may further include the step of determining.

In an embodiment of the present invention, the tenant mapping arrangement indicates an index of a tenant allocated for each CPU core so that a packet currently being processed is a packet owned by a tenant, and the tenant weight arrangement indicates a network scheduling weight for each tenant. And the start queue index array calculates and stores the NIC queue index occupied by each tenant based on the tenant weight array value, and the port number array is the application for which a specific tenant wants to give high priority. The port numbers used can be saved in an array format.

In a computer-readable storage medium according to an embodiment for realizing another object of the present invention, a computer program for performing a method of applying a network policy supporting multiple queues is recorded.

A network policy application apparatus supporting multiple queues according to an embodiment for realizing another object of the present invention described above is, based on the network policy content submitted by a network administrator, a tenant mapping arrangement and a tenant weight arrangement in a module. , A policy initialization unit for initializing a start queue index array and a port number array and variables; Based on the tenant ID obtained from the policy initiating unit, the tenant weight, the tenant's start queue index, and the index tracking the current queue, a network interface card (NIC) queue equal to the weight assigned to each tenant A flat policy enforcement unit that ensures network isolation between tenants by allocating; And a hierarchical policy enforcement unit that guarantees network isolation between applications in the tenant by inserting an application packet having a high priority into the head of Qdisc in order to change the priorities between applications in the tenant.

In an embodiment of the present invention, the flat policy enforcement unit initializes the value corresponding to the current queue index to 0 when the value corresponding to the index tracking the tenant's current queue is equal to or greater than the weight of the corresponding tenant, and is currently being processed. Update the queue mapping metadata of the socket to which the packet belongs to the sum of the index corresponding to the current queue tracking index of the tenant and the starting queue index, and update the index tracking the current queue for the next packet. have.

In an embodiment of the present invention, the layer policy enforcement unit sets the priority metadata value of the socket to which the packet currently being processed belongs to 1 if the port of the packet currently being used is included in the port number array to give a higher priority. In other cases, a lower priority may be given by setting the priority metadata value to 0.

In an embodiment of the present invention, the apparatus for applying a network policy supporting the multi-queue includes whether to enqueue a packet currently being used based on a queue mapping metadata value of a socket to which the packet currently being processed belongs and the priority metadata value. Can be determined.

In an embodiment of the present invention, the tenant mapping arrangement indicates an index of a tenant allocated for each CPU core so that a packet currently being processed is a packet owned by a tenant, and the tenant weight arrangement indicates a network scheduling weight for each tenant. And the start queue index array calculates and stores the NIC queue index occupied by each tenant based on the tenant weight array value, and the port number array is the application for which a specific tenant wants to give high priority. The port numbers used can be saved in an array format.

According to this method of applying a network policy supporting multiple queues, network policies within the server can be applied using multiple packet schedulers with only the existing commercial MQ-NIC, without the cost and replacement time required for new hardware development.

1 is a conceptual diagram of a network server including an apparatus for applying a network policy supporting multiple queues according to an embodiment of the present invention.
2 is a diagram showing an example of a pseudocode of flat policy enforcement of the present invention.
3 is a diagram showing an example of a pseudocode of hierarchical policy enforcement according to the present invention.
4 is a diagram showing an example of a pseudocode of a packet enqueue determination according to the present invention.
5 is an experimental result showing the bandwidth allocated to each tenant by the present invention compared to the prior art.
6 is an experimental result showing the delay time of traffic that the present invention should have a higher priority than the prior art.

DETAILED DESCRIPTION OF THE INVENTION The detailed description of the present invention to be described below refers to the accompanying drawings, which illustrate specific embodiments in which the present invention may be practiced. These embodiments are described in detail sufficient to enable a person skilled in the art to practice the present invention. It is to be understood that the various embodiments of the present invention are different from each other but need not be mutually exclusive. For example, specific shapes, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the present invention in relation to one embodiment. In addition, it should be understood that the location or arrangement of individual components within each disclosed embodiment may be changed without departing from the spirit and scope of the present invention. Accordingly, the detailed description to be described below is not intended to be taken in a limiting sense, and the scope of the present invention, if appropriately described, is limited only by the appended claims, along with all scopes equivalent to those claimed by the claims. In the drawings, like reference numerals refer to the same or similar functions over several aspects.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the drawings.

1 is a conceptual diagram of a network server including an apparatus for applying a network policy supporting multiple queues according to an embodiment of the present invention.

The network policy application device (10, hereinafter device) supporting multiple queues according to the present invention is a packet expressing various packet scheduling methods in a computer server device equipped with network interface cards (NICs) supporting multiple queues. It is a data processing device.

Referring to FIG. 1, an apparatus 100 according to the present invention operates in the form of a Netfilter module between a TCP/IP stack 300 and a Qdisc 500 in a network server 1. The Qdisc 500 operates by one-to-one mapping with queues in the network interface card.

The device 100 according to the present invention performs three steps of policy initialization, flat policy enforcement, and hierarchical policy enforcement, and the policy initialization unit 110 and the flat policy It can be performed through the enforcement unit 130 and the hierarchical policy enforcement unit 150.

The device 100 of the present invention may be installed and executed with software (application) for performing network policy application supporting multiple queues, and the policy initialization unit 110, the flat policy enforcement unit 130, and the The configuration of the hierarchical policy enforcement unit 150 may be controlled by software for performing network policy application supporting the multiple queues executed in the device 100.

The device 100 may be a separate terminal or some modules of the terminal. In addition, the configuration of the policy initialization unit 110, the flat policy enforcement unit 130, and the hierarchical policy enforcement unit 150 may be formed of an integrated module or one or more modules. However, on the contrary, each component may be formed as a separate module.

The device 100 may be movable or fixed. The device 100 may be in the form of a server or an engine, and may be a module, a device, an apparatus, a terminal, a user equipment (UE), or a mobile device (MS). station).

The device 100 may execute or manufacture various software based on an operating system (OS), that is, a system. The operating system is a system program for allowing software to use the hardware of the device, and in the present invention may be a Linux system.

The policy initialization unit 110 initializes a tenant mapping arrangement, a tenant weight arrangement, a start queue index arrangement, a port number arrangement, and variables inside the module based on the network policy contents submitted by the network administrator.

The tenant mapping arrangement indicates the index of a tenant allocated for each CPU core so as to distinguish which tenant-owned packets are currently being processed.

The tenant weight array stores network scheduling weights for each tenant, and the start queue index array calculates and stores a NIC queue index occupied by each tenant based on a tenant weight array value.

In the port number arrangement, if there is an application that a specific tenant wants to give high priority to, the port number used by the application is stored in an array format.

The flat policy enforcement unit 130 is based on the tenant ID obtained from the policy initialization unit 110, the tenant weight, the start queue index of the tenant, and the index for tracking the current queue, based on the weight assigned to each tenant. Network Interface Cards (NIC) queues are allocated to ensure network isolation between tenants.

To this end, when the value corresponding to the index tracking the current queue of the tenant is equal to or greater than the weight of the corresponding tenant, the flat policy enforcement unit 130 initializes the value corresponding to the current queue index to 0.

In addition, the flat policy enforcement unit 130 updates the queue mapping metadata of the socket to which the packet currently being processed belongs to the sum of the value corresponding to the index tracking the current queue of the tenant and the start queue index, and then Update the index tracking the current queue for packets.

The hierarchical policy enforcement unit 150 guarantees network isolation between applications in the tenant by inserting an application packet with a high priority into the head of Qdisc in order to change the priorities between applications in the tenant.

If the port of the packet currently being used is included in the port number array, the layer policy enforcement unit 150 sets the priority metadata value of the socket to which the packet currently being processed belongs to 1, and assigns a higher priority. In the case of, the priority metadata value is set to 0 to give a lower priority.

The apparatus 100 according to the present invention includes a queue mapping metadata value of a socket to which the packet currently being processed, received from the flat policy enforcement unit 130, belongs, and the priority meta data transmitted from the layer policy enforcement unit 150. Determines whether to enqueue a packet currently in use based on the data value.

The policy initialization unit 110, the flat policy enforcement unit 130, and the hierarchical policy enforcement unit 150 respectively perform policy initialization, flat policy enforcement, and hierarchical policy enforcement. Policy Enforcement) will be described in detail below.

In the first step, the policy initialization step, the array and variables inside the device 100 are initialized based on the network policy contents submitted by the network administrator.

The device 100 uses four arrays of a tenant mapping array, a tenant weight array, a start queue index array, and a port number array.

The tenant mapping array indicates the index of the tenant allocated for each CPU core. Through the sender_cpu metadata of the socket buffer (SKB), the index of the CPU core responsible for the packet currently being processed can be known. Accordingly, referring to the tenant mapping array value managed by the device 100, it is possible to distinguish which tenant-owned packets are currently being processed.

The tenant weight array is an array that stores network scheduling weights for each tenant.

The start queue index array calculates and stores a NIC queue index occupied by each tenant based on a tenant weight array value. For example, if two tenants 0 and 1 have weights of 2 and 1, respectively, the value of the start queue index array is {0,0,1}.

In the port number arrangement, if there is an application that a specific tenant wants to assign a high priority to among the applications it uses, the port number used by the application is stored in an array format.

In the second phase, the Flat policy enforcement phase, it ensures network isolation between tenants. The device 100 allocates a NIC queue equal to the weight assigned to each tenant. Through this, a weight-based packet scheduler can be expressed indirectly.

2 shows the pseudocode of this step. In order to determine the queue number of the packet currently being processed, a tenant ID, a tenant weight, a tenant start queue index, and an index tracking the current queue index are needed (lines 1-5 of FIG. 2). These values can be obtained by the arrays initialized in step 1 (lines 7-8 of FIG. 2).

For reference, c _i is initialized to 0 in step 1. In order to distribute packets evenly to the allocated queues, c _i is initialized whenever the corresponding value exceeds w _i (lines 11-13 of FIG. 2).

The device 100 updates the queue_mapping metadata of the socket to which the packet currently being processed belongs to the sum of the index value obtained in this step with the start queue index (line 14 of FIG. 2), and the tracking index for the next packet is also Update (line 15 in Fig. 2).

The third step, Hierarchical Policy Enforcement, ensures network isolation between applications in tenants. In order to change the priorities between applications within a tenant, the device 100 inserts an application packet with a high priority into the head of qdisc, not the tail.

For reference, in the device 100, qdisc and NIC queues are mapped and synchronized one-to-one. When inserted into the head of qdisc, other packets currently buffered in qdisc are skipped, so priority scheduling can be expressed indirectly without priority scheduling.

3 shows a pseudo code of a hierarchical policy enforcement process. If the port of the packet currently being used is included in the port number array, the device 100 sets the priority metadata value of SKB to 1 to give a high priority (line 5-6 of FIG. 3). Otherwise, the priority metadata value is set to 0 and a lower priority is given (lines 7-8 of FIG. 3).

4 shows how the device 100 makes a packet enqueue decision. Based on the values processed through the device 100, qdisc indirectly expresses various packet scheduling, and the packets of qdisc are passed down to the NIC, thereby achieving the goal.

The multiq qdisc supporting multi-queue scheduling is obtained by referring to the queue_mapping metadata for the NIC queue index value obtained in FIG. 2 (line 5 of FIG. 4). In addition, the priority metadata value obtained in FIG. 3 is obtained (line 6 in FIG. 4).

Through this, qdisc performs tail enqueue or head enqueue according to the priority value, and packets are always inserted into the queue corresponding to queue_mapping (lines 5-8 of FIG. 4).

In order to evaluate the effectiveness of the present invention, the device 100 is implemented as a Netfilter module on Linux, and a test bed in which two servers equipped with Intel 82599 10GbE NICs are connected to a 10Gbps switch is configured, and iperf and sockperf are connected. The experiment used was carried out. The comparison target was XPS, which is a NIC queue allocation method supported by the current Linux kernel.

In FIG. 5, it is assumed that there are three tenants, and each tenant 1,2,3 has weights of 1,2,3 in order. Each tenant generates 8, 16, and 32 flows every 5 seconds from 0 seconds.

Referring to FIG. 5, it can be seen that the device 100 guarantees a bandwidth equal to the weight allocated to each tenant. On the other hand, it can be seen that XPS allocates more bandwidth to tenants with a large number of flows. This is because XPS cannot isolate traffic per tenant.

6 shows the delay time experienced by sockperf traffic, which should have a high priority, when two tenants have the same weight and generate 8 flows in both tenants with iperf. Since the device 100 guarantees network isolation between applications in a tenant through head enqueue, it can be seen that the delay is lower than that of XPS.

In addition, the right side of FIG. 6 shows Jain's fairness index showing how equally each tenant shares the bandwidth, and it can be seen that TONIC shows perfect fairness equal to 1.

Such a method of applying a network policy supporting multiple queues may be implemented as an application or in the form of program instructions that can be executed through various computer components and recorded in a computer-readable recording medium. The computer-readable recording medium may include program instructions, data files, data structures, etc. alone or in combination.

The program instructions recorded in the computer-readable recording medium may be specially designed and constructed for the present invention, and may be known and usable to those skilled in the computer software field.

Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magnetic-optical media such as floptical disks. media), and a hardware device specially configured to store and execute program instructions such as ROM, RAM, flash memory, and the like.

Examples of the program instructions include not only machine language codes such as those produced by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform processing according to the present invention, and vice versa.

Although the above has been described with reference to embodiments, it is understood that those skilled in the art can variously modify and change the present invention without departing from the spirit and scope of the present invention described in the following claims. You can understand.

The present invention can be applied to a network server using a Linux operating system, and further, can be applied to the entire ICT market using wired/wireless networking/communication equipment.

1: network server
100: network policy application device supporting multiple queues
110: policy initialization unit
130: Flat Policy Enforcement Department
150: Hierarchy Policy Enforcement Department
300: TCP/IP stack
500: Qdisc

Claims (13)

Initializing a tenant mapping array, a tenant weight array, a start queue index array, and a port number array and variables inside the module based on the network policy content submitted by the network administrator;
Based on the tenant ID obtained from the initialized array, the tenant weight, the tenant's starting queue index, and the index tracking the current queue, network interface cards (NIC) queues equal to the weight assigned to each tenant are allocated. Thereby ensuring network isolation between tenants; And
A method of applying a network policy supporting multiple queues, including; inserting a high-priority application packet into the head of Qdisc to ensure network isolation between applications in the tenant in order to change the priorities between applications in the tenant.
The method of claim 1, wherein the step of ensuring network isolation between tenants,
Network policy application method that supports multiple queues in which the value corresponding to the current queue index is initialized to 0 when the value corresponding to the index tracking the tenant's current queue is greater than or equal to the weight of the corresponding tenant.
The method of claim 2, wherein the step of ensuring network isolation between tenants,
A network policy application method supporting multiple queues, in which queue mapping metadata of a socket to which a packet currently being processed belongs is updated with a value corresponding to a value corresponding to an index tracking the current queue of the tenant and a value corresponding to the sum of the start queue index.
The method of claim 3, wherein the step of ensuring network isolation between tenants,
A method of applying a network policy supporting multiple queues, further comprising updating an index tracking a current queue for a next packet.
The method of claim 3, wherein ensuring network isolation between applications in the tenant comprises:
If the port of the packet currently in use is included in the port number array, the priority metadata value of the socket to which the packet currently being processed belongs is set to 1 to give a higher priority. Otherwise, the priority metadata value is set to 0. A network policy application method that supports multiple queues, giving low priority by setting to.
The method of claim 5,
The method of applying a network policy supporting multiple queues, further comprising determining whether to enqueue a packet currently being used based on a queue mapping metadata value of a socket to which the packet currently being processed belongs and the priority metadata value.
The method of claim 1,
The tenant mapping array indicates the index of the tenant allocated for each CPU core so that the packet currently being processed is a packet owned by which tenant, and
The tenant weight array stores network scheduling weights for each tenant,
The start queue index array calculates and stores the NIC queue index occupied by each tenant based on the tenant weight array value,
The port number arrangement is a method of applying a network policy supporting multiple queues in which, if there is an application that a specific tenant wants to give high priority to, the port number used by the application is stored in an array form.
A computer-readable recording medium having a computer program recorded thereon for performing the method for applying a network policy supporting the multi-queue according to any one of claims 1 to 7.
A policy initialization unit that initializes a tenant mapping array, a tenant weight array, a start queue index array, and a port number array and variables inside the module based on the network policy content submitted by the network administrator;
Based on the tenant ID obtained from the policy initiating unit, the tenant weight, the tenant's start queue index, and the index tracking the current queue, a network interface card (NIC) queue equal to the weight assigned to each tenant A flat policy enforcement unit that ensures network isolation between tenants by allocating; And
A network policy application device that supports multiple queues, including; a hierarchical policy enforcement unit that guarantees network isolation between applications in the tenant by inserting a high-priority application packet into the head of Qdisc to change the priorities between applications in the tenant .
The method of claim 9, wherein the flat policy enforcement unit,
If the value corresponding to the index tracking the current queue of the tenant is equal to or greater than the weight of the corresponding tenant, the value corresponding to the current queue index is initialized to 0,
Update the queue mapping metadata of the socket to which the packet currently being processed belongs to the sum of the value corresponding to the index for tracking the current queue of the tenant and the start queue index, and
Network policy enforcement device supporting multiple queues, updating the index tracking the current queue for the next packet.
The method of claim 10, wherein the hierarchical policy enforcement unit,
If the port of the packet currently in use is included in the port number array, the priority metadata value of the socket to which the packet currently being processed belongs is set to 1 to give a higher priority. Otherwise, the priority metadata value is set to 0. Network policy application device that supports multiple queues, giving low priority by setting to.
The method of claim 11,
A network policy application device supporting multiple queues for determining whether to enqueue a currently used packet based on a queue mapping metadata value of a socket to which the packet currently being processed belongs and the priority metadata value.
The method of claim 9,
The tenant mapping array indicates the index of the tenant allocated for each CPU core so that the packet currently being processed is a packet owned by which tenant, and
The tenant weight array stores network scheduling weights for each tenant,
The start queue index array calculates and stores the NIC queue index occupied by each tenant based on the tenant weight array value,
The port number arrangement is a network policy application device supporting multiple queues for storing the port numbers used by the application in the form of an array if there is an application for which a specific tenant wants to give high priority.

Images